Contact point
1. Each Member State shall designate at least one central authority as a contact point for the implementation of this Regulation. Where a Member State has designated more than one central authority, it shall designate which of those authorities will be the contact point for the implementation of this Regulation. It shall communicate the name of that authority to the Commission and the other Member States. If a Member State changes its designated authority, it shall inform the Commission and the other Member States accordingly.
2. Member States shall ensure that the contact points are aware of relevant information and assistance services at Union level included in the Single Digital Gateway set out in Regulation (EU) 2018/1724 of the European Parliament and of the Council ( 13 ) and that they are able to cooperate with such services.
Collection of biometric identifiers
1. The biometric identifiers shall be collected solely by qualified and duly authorised staff designated by the authorities responsible for issuing identity cards or residence cards, for the purpose of being integrated into the highly secure storage medium provided for in Article 3(5) for identity cards and in Article 7(1) for residence cards. By way of derogation from the first sentence, fingerprints shall be collected solely by qualified and duly authorised staff of such authorities, except in the case of applications submitted to the diplomatic and consular authorities of the Member State.
With a view to ensuring the consistency of biometric identifiers with the identity of the applicant, the applicant shall appear in person at least once during the issuance process for each application.
2. Member States shall ensure that appropriate and effective procedures for the collection of biometric identifiers are in place and that those procedures comply with the rights and principles set out in the Charter, the Convention for the Protection of Human Rights and Fundamental Freedoms and the United Nations Convention on the Rights of the Child.
Where difficulties are encountered in the collection of biometric identifiers, Member States shall ensure that appropriate procedures are in place to respect the dignity of the person concerned.
3. Biometric identifiers stored for the purpose of personalisation of identity cards or residence documents shall be kept in a highly secure manner and no longer than 90 days from the date of issue. After that period, those biometric identifiers shall be immediately erased or destroyed. This shall be without prejudice to their retention where required by Union or national law, in compliance with Union data protection law.
Protection of personal data and liability
1. Without prejudice to Regulation (EU) 2016/679, Member States shall ensure the security, integrity, authenticity and confidentiality of the data collected, accessed and stored for the purpose of this Regulation.
2. For the purpose of this Regulation, the authorities responsible for issuing identity cards and residence documents shall be considered as the controller referred to in Article 4, point (7), of Regulation (EU) 2016/679 and shall have responsibility for the processing of personal data.
3. Member States shall ensure that supervisory authorities can fully exercise their tasks as referred to in Regulation (EU) 2016/679, including access to all personal data and all necessary information as well as access to any premises or data processing equipment of the competent authorities.
4. Cooperation with external service providers shall not exclude any liability on the part of a Member State which may arise under Union or national law in respect of breaches of obligations with regard to personal data.
5. Information in machine-readable form shall only be included in an identity card or residence document in accordance with this Regulation and the national law of the issuing Member State.
6. The facial image of the holder stored on the storage medium of identity cards and residence documents shall only be accessed by duly authorised staff of competent national authorities, Union agencies and private entities and in compliance with Union data protection law for the purposes of verifying:
(a)
the authenticity of the identity card or residence document;
(b)
the identity of the holder by means of directly available comparable features where the identity card or residence document is required to be produced by law.
Access to the facial image by private entities shall also require the consent of the holder, unless access regardless of consent is strictly necessary for the purposes set out in the first subparagraph and provided for by Union or national law in compliance with Union data protection law.
The facial image accessed pursuant to the first subparagraph shall not be retained unless its further processing is necessary for the purposes set out in first subparagraph and is provided for by Union or national law, in compliance with Union data protection law. The facial image shall not be retained for longer than is necessary for those purposes, otherwise it shall be deleted as soon as the verification referred to in the first subparagraph has been completed and shall not be transferred to third countries or international organisations unless permitted by Union data protection law.
7. The two fingerprints of the holder stored on the storage medium of identity cards and residence documents shall only be accessed:
(a)
for the purposes set out in paragraph 6, first subparagraph;
(b)
in compliance with Union data protection law;
(c)
by duly authorised staff of competent national authorities and Union agencies; and
(d)
where the document is required to be produced by Union or national law.
The two fingerprints accessed pursuant to this paragraph shall not be retained.
Monitoring
1. By 11 July 2026, the Commission shall establish a detailed programme for monitoring the outputs, results and impact of this Regulation, including its impact on fundamental rights.
2. The monitoring programme shall set out the means by which and the intervals at which the data and other necessary evidence are to be collected. It shall specify the action to be taken by the Commission and by Member States in collecting and analysing the data and other evidence.
3. Member States shall provide the Commission with the data and other evidence necessary for such monitoring.
Evaluation
1. By 11 July 2031, the Commission shall carry out an evaluation of this Regulation and present a report on the main findings to the European Parliament, to the Council and to the European Economic and Social Committee. The report shall in particular focus on:
(a)
the impact of this Regulation on fundamental rights;
(b)
the mobility of Union citizens;
(c)
the effectiveness of biometric verification in ensuring the security of travel documents;
(d)
a possible further visual harmonisation of identity cards;
(e)
the necessity of further harmonising the security features of residence documents.
2. Member States and relevant Union agencies shall provide the Commission with the information necessary for the preparation of that report.
Additional technical specifications
1. In order to ensure, where appropriate, that identity cards and residence documents referred to in Article 2, points (a) and (c), comply with future minimum security standards, the Commission shall establish, by means of implementing acts, additional technical specifications, relating to the following:
(a)
additional security features and requirements, including enhanced anti-forgery, counterfeiting and falsification standards;
(b)
technical specifications for the storage medium of the biometric features referred to in Article 3(5) and their security, including prevention of unauthorised access and facilitation of validation;
(c)
requirements for quality and common technical standards for the facial image and the fingerprints.
Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 15(2).
2. In accordance with the procedure referred to in Article 15(2), it may be decided that the specifications referred to in this Article are to be secret and are not to be published. In such a case, they shall be made available only to the bodies designated by the Member States as responsible for printing and to persons duly authorised by a Member State or by the Commission.
3. Each Member State shall designate one body having responsibility for printing identity cards, and one body having responsibility for printing residence cards of family members of Union citizens, and shall communicate the names of such bodies to the Commission and to the other Member States. Member States shall be entitled to change such designated bodies and shall inform the Commission and the other Member States accordingly.
Member States may also decide to designate a single body having responsibility for printing both identity cards and residence cards of family members of Union citizens and shall communicate the name of that body to the Commission and to the other Member States.
Two or more Member States may also decide to designate a single body for those purposes and shall inform the Commission and the other Member States accordingly.
Committee procedure
1. The Commission shall be assisted by the Committee established by Article 6 of Regulation (EC) No 1683/95. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011.
2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply.
Where the committee delivers no opinion, the Commission shall not adopt the draft implementing act and Article 5(4), third subparagraph, of Regulation (EU) No 182/2011 shall apply.
Entry into force
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union .
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
